How to remove 9tb8f.exe

9tb8f.exe , zoorfat.exe

Files size 180,316 bytes

MD5: 462AF598BAFF035B56A5C16C3035F7A8

SHA-1: 75CD4E3F3B9D4D89D2093AB02D498AD22FAB8177

32bbi0.exe , cyban.exe

Files 183,261 bytes

MD5: 0500F03203B1F4119CBC149E1441E819

SHA-1: E7DF89187E62A7903D4E421AFC868ACD3216C8DE

=================================================

Files Created

%System%\zoorfat.exe

%System%\cyban.exe

%System%\ieban0.dll (0-9)

%System%\zorie0.dll (0-9)

%System%\zormn0.dll (0-9)

X:\9tb8f.exe

X:\32bbi0.exe

X:\autorun.inf

%Temp% = C:\Documents and Settings\[UserName]\Local Settings\Temp\

%System% =C:\Windows\system32\

%Windir% = C:\Windows\

X:\ = C:\ - Z:\

Registry Modifications

Key Added

HKLM\SOFTWARE\Classes\CLSID\MNDOWN

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\InprocServer32

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\ProgID

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\Programmable

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\VersionIndependentProgID

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid32

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\TypeLib

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\0

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\0\win32

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\FLAGS

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\HELPDIR

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\

Browser Helper Objects\{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}

Values Added

HKLM\SOFTWARE\Classes\CLSID\MNDOWN\urlinfo = "chtovj.v"

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\VersionIndependentProgID\

(Default) = "IEHlprObj.IEHlprObj"

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\ProgID\

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\InprocServer32\

(Default) = "%System%\ieban0.dll"

ThreadingModel = "Apartment"

HKLM\SOFTWARE\Classes\CLSID\

{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}\

(Default) = "IEHlprObj Class"

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\TypeLib\

(Default) = "{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}"

Version = "1.0"

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid32\

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}\ProxyStubClsid\

(Default) = "{00020424-0000-0000-C000-000000000046}"

HKLM\SOFTWARE\Classes\Interface\

{7F23592C-8F2C-4C08-83A8-BBE01BF9CC64}]

(Default) = "IIEHlprObj"

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\0\win32\

(Default) = "%System%\ieban0.dll"

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\HELPDIR\

(Default) = "%System%\"

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\FLAGS\

(Default) = "0"

HKLM\SOFTWARE\Classes\TypeLib\

{7F235922-8F2C-4C08-83A8-BBE01BF9CC64}\1.0\

(Default) = "IEHelper 1.0 Type Library"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer\

(Default) = "IEHlprObj.IEHlprObj.1"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj\

(Default) = "IEHlprObj Class"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID]

(Default) = "{7F23592B-8F2C-4C08-83A8-BBE01BF9CC64}"

HKLM\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\

(Default) = "IEHlprObj Class"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\

zoorfat = "%System%\zoorfat.exe"

cybansos = "%System%\cyban.exe"

Values modified

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\ Folder\Hidden\SHOWALL\CheckedValue: 0x00000000

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\Hidden: 0x00000002

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\

Advanced\ShowSuperHidden: 0x00000000

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

NoDriveTypeAutoRun: 0x00000091

Remote Host

218.59.144.138 port 80

218.59.144.142 port 80

URLs to be download/data identified

hxxp://dfsd6.com/1hg/ah1.rar > %temp%\ah1.exe

hxxp://www.googled3m.com/1hg/ah.rar > %temp%\ah.exe

=======================================================

วิธีกำจัด/แก้ virus : 9tb8f.exe , zoorfat.exe , 32bbi0.exe , cyban.exe

=======================================================

Download Fix Tool : PeeTechFix-Win32/PSW.OnlineGame 2.0.5